README
¶
Kubernetes Resource Type Metadata
This package contains per-resource-type metadata used by ConfigHub's Kubernetes functions. When adding support for new CRDs or custom resource types, update the relevant files described below.
Files to update
public/configkit/k8skit/immutable_fields.go
Maps resource types to field paths that cannot be changed after creation (require delete + recreate). Sources of truth for immutability:
- Built-in K8s types:
pkg/apis/*/validation/validation.goin the Kubernetes source - ACK CRDs:
is_immutable: trueingenerator.yaml, orx-kubernetes-validationsrules withself == oldSelf - Other CRDs: look for "immutable", "cannot be updated", or "cannot be changed" in CRD field descriptions, and for immutability checks in controller reconciliation code
public/configkit/k8skit/merge_keys.go
Maps resource types to strategic merge patch keys for array fields. These determine how list items are matched during merges (e.g., containers matched by name). Sources:
- Built-in K8s types:
x-kubernetes-patch-merge-keyin the Kubernetes OpenAPI/Swagger spec, orpatchMergeKeystruct tags in Go types - CRDs:
x-kubernetes-list-map-keysandx-kubernetes-list-type: mapin the CRD schema
Pod-spec merge keys shared across workloads are in PodSpecMergeKeyFields; per-type prefixes are in WorkloadMergeKeyFields.
reference_fields.go
Maps resource types to fields that reference other Kubernetes resources. This enables cross-resource dependency tracking. The Target field uses group/version/Kind format.
- ACK CRDs: references follow the
spec.<field>Ref.from.namepattern (single) orspec.<field>Refs.*.from.name(list) - Other CRDs: look for fields named
*Ref,*SecretName,*ServiceAccountName,*ConfigMapRef, etc.
public/configkit/k8skit/cluster_resource_types.go
Lists cluster-scoped (non-namespaced) resource types. Check the scope field in a CRD's spec. Most CRDs are Namespaced; only add types here if scope: Cluster.
Resource type format
All resource types use group/version/Kind format throughout:
v1/Pod # core API (no group)
apps/v1/Deployment # grouped API
eks.services.k8s.aws/v1alpha1/Cluster # CRD
Adding a new controller's types
- Read the CRD YAML files and controller source code
- Check
scope:for cluster-scoped types and add tocluster_resource_types.go - Search for immutability markers and add to
public/configkit/k8skit/immutable_fields.go - Check for strategic merge keys and add to
public/configkit/k8skit/merge_keys.go - Identify cross-resource reference fields and add to
reference_fields.go - Run
make build-funcexec && make test-publicto verify
Documentation
¶
Index ¶
- Constants
- func InitSchemaFinder() error
- func K8sCELEnvOpts() []cel.EnvOption
- func RegisterFunctions(rp *k8skit.K8sResourceProviderType, fh handler.FunctionRegistry)
- func VetValidatingAdmissionPolicy(rp yamlkit.ResourceProvider, options *api.FunctionOptions, ...) (gaby.Container, any, error)
- type ResourceQuantityComparison
- type SchemaFinder
- type SchemaInfo
Constants ¶
const AttributeNameAnnotationValue = api.AttributeNameAnnotationValue
const AttributeNameLabelValue = api.AttributeNameLabelValue
const AttributeNameMetadataName = api.AttributeName("metadata-name")
const AttributeNameNamespaceNameReference = api.AttributeName("namespace-name-reference")
const (
AttributeNameWorkloadLabels = k8skit.AttributeNameWorkloadLabels
)
The attributes carrying pod labels are declared in k8skit, beside the specs that say where they live. workload-labels is the group standing for both.
const PolicyOtherDataKey = api.OtherDataSource("policy")
PolicyOtherDataKey is the key of the OtherData vet-validating-admission-policy reads its ValidatingAdmissionPolicies from.
Variables ¶
This section is empty.
Functions ¶
func InitSchemaFinder ¶
func InitSchemaFinder() error
func K8sCELEnvOpts ¶ added in v0.2.8
K8sCELEnvOpts returns the additional CEL environment options that provide Kubernetes-specific CEL libraries matching the admission policy environment. This includes quantity(), url(), ip(), cidr(), regex(), and format() functions.
It is exported so that callers evaluating CEL against Kubernetes configuration outside the function executor -- such as a server-side View column read from stored JSON -- get the same environment the get-cel function provides.
func RegisterFunctions ¶
func RegisterFunctions(rp *k8skit.K8sResourceProviderType, fh handler.FunctionRegistry)
RegisterFunctions registers all Kubernetes functions onto the provided FunctionHandler using the given registrar's resource provider.
func VetValidatingAdmissionPolicy ¶ added in v0.11.0
func VetValidatingAdmissionPolicy(rp yamlkit.ResourceProvider, options *api.FunctionOptions, parsedData, policyData gaby.Container) (gaby.Container, any, error)
VetValidatingAdmissionPolicy evaluates the ValidatingAdmissionPolicies policyData holds, the data of the Unit passed as OtherData policy, against each resource of parsedData.
Types ¶
type ResourceQuantityComparison ¶
type ResourceQuantityComparison struct {
// contains filtered or unexported fields
}
ResourceQuantityComparison implements CustomStringComparator for Kubernetes resource quantities
func NewResourceQuantityComparison ¶
func NewResourceQuantityComparison() *ResourceQuantityComparison
NewResourceQuantityComparison creates a new ResourceQuantityComparison instance
func (*ResourceQuantityComparison) Evaluate ¶
func (r *ResourceQuantityComparison) Evaluate(expr *api.RelationalExpression, value string) (bool, error)
Evaluate implements CustomStringComparator.Evaluate
func (*ResourceQuantityComparison) MatchesPath ¶
func (r *ResourceQuantityComparison) MatchesPath(path string) bool
MatchesPath implements CustomStringComparator.MatchesPath
type SchemaFinder ¶
type SchemaFinder struct {
// contains filtered or unexported fields
}
func NewSchemaFinder ¶
func NewSchemaFinder() (*SchemaFinder, error)
func (*SchemaFinder) LookupPath ¶
func (e *SchemaFinder) LookupPath(gvkString, fieldPath string) (*SchemaInfo, error)
type SchemaInfo ¶
type SchemaInfo struct {
Description string
}
func LookupPath ¶
func LookupPath(gvkString, fieldPath string) (*SchemaInfo, error)
Source Files